lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 3 Jul 2011 12:10:29 -0700 From: Linus Torvalds <torvalds@...ux-foundation.org> To: Vasiliy Kulikov <segoon@...nwall.com> Cc: kernel-hardening@...ts.openwall.com, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org, Arnd Bergmann <arnd@...db.de>, Christoph Lameter <cl@...ux-foundation.org>, Pekka Enberg <penberg@...nel.org>, Matt Mackall <mpm@...enic.com>, Andrew Morton <akpm@...ux-foundation.org>, linux-kernel@...r.kernel.org, linux-arch@...r.kernel.org, linux-mm@...ck.org Subject: Re: [RFC v1] implement SL*B and stack usercopy runtime checks On Sun, Jul 3, 2011 at 11:57 AM, Vasiliy Kulikov <segoon@...nwall.com> wrote: >> If you seriously clean it up (that at a minimum includes things like >> making it configurable using some pretty helper function that just >> compiles away for all the normal cases, > > Hm, it is not as simple as it looks at the first glance - even if the > object size is known at the compile time (__compiletime_object_size), it > might be a field of a structure, which crosses the slab object > boundaries because of an overflow. No, I was more talking about having something like #ifdef CONFIG_EXPENSIVE_CHECK_USERCOPY extern int check_user_copy(const void *kptr, unsigned long size); #else static inline int check_user_copy(const void *kptr, unsigned long size) { return 0; } #endif so that the actual user-copy routines end up being clean and not have #ifdefs in them or any implementation details like what you check (stack, slab, page cache - whatever) If you can also make it automatically not generate any code for cases that are somehow obviously safe, then that's an added bonus. But my concern is that performance is a real issue, and the strict user-copy checking sounds like mostly a "let's enable this for testing kernels when chasing some particular issue" feature, the way DEBUG_PAGEALLOC is. And at the same time, code cleanliness and maintainability is a big deal, so the usercopy code itself should have minimal impact and look nice regardless (which is why I strongly object to that kind of "(!slab_access_ok(to, n) || !stack_access_ok(to, n))" crud - the internal details of what you check are *totally* irrelevant to the usercopy code. Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists